CVE-2017-8868: Flatcore Flatcore-CMS

High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days.

acp/core/files.browser.php in flatCore 1.4.7 allows file deletion via directory traversal in the delete parameter to acp/acp.php. The risk might be limited to requests submitted through CSRF.

Affected products

• Flatcore Flatcore-CMS: version 1.4.7 only

Published 2017-05-10. Last modified 2026-06-17.